IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

AuthN: Add session client (#60894)

Browse Source 
* add basic session client

* populate UserToken in ReqContext

* token rotation as a post auth hook

* fixed in context handler

* add session token rotation

* add session token tests

* use namespacedID constructor
This commit is contained in:
Jo
2023-01-04 15:10:43 +00:00
committed by GitHub
parent ebb34560a4
commit a226903ec6
10 changed files with 380 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/services/authn/authnimpl/service.go
View File

@@ -9,6 +9,7 @@ import (
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/apikey"
"github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/authn"
sync "github.com/grafana/grafana/pkg/services/authn/authnimpl/usersync"
"github.com/grafana/grafana/pkg/services/authn/clients"
@@ -26,8 +27,11 @@ import (
var _ authn.Service = new(Service)
func ProvideService(
cfg *setting.Cfg, tracer tracing.Tracer, orgService org.Service, accessControlService accesscontrol.Service,
apikeyService apikey.Service, userService user.Service, loginAttempts loginattempt.Service, quotaService quota.Service,
cfg *setting.Cfg, tracer tracing.Tracer,
orgService org.Service, sessionService auth.UserTokenService,
accessControlService accesscontrol.Service,
apikeyService apikey.Service, userService user.Service,
loginAttempts loginattempt.Service, quotaService quota.Service,
authInfoService login.AuthInfoService, renderService rendering.Service,
) *Service {
s := &Service{
@@ -41,6 +45,10 @@ func ProvideService(
s.clients[authn.ClientRender] = clients.ProvideRender(userService, renderService)
s.clients[authn.ClientAPIKey] = clients.ProvideAPIKey(apikeyService, userService)
sessionClient := clients.ProvideSession(sessionService, userService, cfg.LoginCookieName, cfg.LoginMaxLifetime)
s.clients[authn.ClientSession] = sessionClient
s.RegisterPostAuthHook(sessionClient.RefreshTokenHook)
if s.cfg.AnonymousEnabled {
s.clients[authn.ClientAnonymous] = clients.ProvideAnonymous(cfg, orgService)
}
@@ -107,7 +115,7 @@ func (s *Service) Authenticate(ctx context.Context, client string, r *authn.Requ
params := c.ClientParams()
for _, hook := range s.postAuthHooks {
if err := hook(ctx, params, identity); err != nil {
if err := hook(ctx, params, identity, r); err != nil {
return nil, false, err
}
}

3
pkg/services/authn/authnimpl/usersync/orgsync.go
View File

@@ -27,7 +27,8 @@ type OrgSync struct {
log log.Logger
}
func (s *OrgSync) SyncOrgUser(ctx context.Context, clientParams *authn.ClientParams, id *authn.Identity) error {
func (s *OrgSync) SyncOrgUser(ctx context.Context,
clientParams *authn.ClientParams, id *authn.Identity, _ *authn.Request) error {
if !clientParams.SyncUser {
s.log.Debug("Not syncing org user", "auth_module", id.AuthModule, "auth_id", id.AuthID)
return nil

2
pkg/services/authn/authnimpl/usersync/orgsync_test.go
View File

@@ -113,7 +113,7 @@ func TestOrgSync_SyncOrgUser(t *testing.T) {
accessControl: tt.fields.accessControl,
log: tt.fields.log,
}
if err := s.SyncOrgUser(tt.args.ctx, tt.args.clientParams, tt.args.id); (err != nil) != tt.wantErr {
if err := s.SyncOrgUser(tt.args.ctx, tt.args.clientParams, tt.args.id, nil); (err != nil) != tt.wantErr {
t.Errorf("OrgSync.SyncOrgUser() error = %v, wantErr %v", err, tt.wantErr)
}

3
pkg/services/authn/authnimpl/usersync/usersync.go
View File

@@ -25,7 +25,8 @@ type UserSync struct {
}
// SyncUser syncs a user with the database
func (s *UserSync) SyncUser(ctx context.Context, clientParams *authn.ClientParams, id *authn.Identity) error {
func (s *UserSync) SyncUser(ctx context.Context,
clientParams *authn.ClientParams, id *authn.Identity, _ *authn.Request) error {
if !clientParams.SyncUser {
s.log.Debug("Not syncing user", "auth_module", id.AuthModule, "auth_id", id.AuthID)
return nil

2
pkg/services/authn/authnimpl/usersync/usersync_test.go
View File

@@ -430,7 +430,7 @@ func TestUserSync_SyncUser(t *testing.T) {
quotaService: tt.fields.quotaService,
log: tt.fields.log,
}
err := s.SyncUser(tt.args.ctx, tt.args.clientParams, tt.args.id)
err := s.SyncUser(tt.args.ctx, tt.args.clientParams, tt.args.id, nil)
if tt.wantErr {
require.Error(t, err)
return